Privacy Law Commons^™

Data Collection, Ehrs, And Poverty Determinations, Craig Konnoth

Publications

Collecting and deploying poverty-related data is an important starting point for leveraging data regarding social determinants of health in precision medicine. However, we must rethink how we collect and deploy such data. Current modes of collection yield imprecise data that is unsuited for research. Better data can be collected by cross-referencing other sources such as employers and public benefit programs, and by incentivizing and encouraging patients and providers to provide more accurate information. Data thus collected can be used to provide appropriate individual-level clinical and non-clinical care, and to systematically determine what share of social resources healthcare should consume.

Privacy's Double Standards, Scott Skinner-Thompson

Publications

Where the right to privacy exists, it should be available to all people. If not universally available, then privacy rights should be particularly accessible to marginalized individuals who are subject to greater surveillance and are less able to absorb the social costs of privacy violations. But in practice, there is evidence that people of privilege tend to fare better when they bring privacy tort claims than do non-privileged individuals. This disparity occurs despite doctrine suggesting that those who occupy prominent and public social positions are entitled to diminished privacy tort protections.

This Article unearths disparate outcomes in public disclosure tort …

Criminal Employment Law, Benjamin Levin

Publications

This Article diagnoses a phenomenon, “criminal employment law,” which exists at the nexus of employment law and the criminal justice system. Courts and legislatures discourage employers from hiring workers with criminal records and encourage employers to discipline workers for non-work-related criminal misconduct. In analyzing this phenomenon, my goals are threefold: (1) to examine how criminal employment law works; (2) to hypothesize why criminal employment law has proliferated; and (3) to assess what is wrong with criminal employment law. This Article examines the ways in which the laws that govern the workplace create incentives for employers not to hire individuals with …

That Was Close! Reward Reporting Of Cybersecurity “Near Misses”, Jonathan Bair, Steven M. Bellovin, Andrew Manley, Blake Reid, Adam Shostak

Publications

Building, deploying, and maintaining systems with sufficient cybersecurity is challenging. Faster improvement would be valuable to society as a whole. Are we doing as much as we can to improve? We examine robust and long-standing systems for learning from near misses in aviation, and propose the creation of a Cyber Safety Reporting System (CSRS).

To support this argument, we examine the liability concerns which inhibit learning, including both civil and regulatory liability. We look to the way in which cybersecurity engineering and science is done today, and propose that a small amount of ‘policy entrepreneurship’ could have substantial positive impact. …

Averting Robot Eyes, Margot Kaminski, Matthew Rueben, William D. Smart, Cindy M. Grimm

Publications

Home robots will cause privacy harms. At the same time, they can provide beneficial services—as long as consumers trust them. This Essay evaluates potential technological solutions that could help home robots keep their promises, avert their eyes, and otherwise mitigate privacy harms. Our goals are to inform regulators of robot-related privacy harms and the available technological tools for mitigating them, and to spur technologists to employ existing tools and develop new ones by articulating principles for avoiding privacy harms.

We posit that home robots will raise privacy problems of three basic types: (1) data privacy problems; (2) boundary management problems; …

Entrepreneurial Administration, Philip J. Weiser

Publications

A core failing of today’s administrative state and modern administrative law scholarship is the lack of imagination as to how agencies should operate. On the conventional telling, public agencies follow specific grants of regulatory authority, use the traditional tools of notice-and-comment rulemaking and adjudication, and are checked by judicial review. In reality, however, effective administration depends on entrepreneurial leadership that spearheads policy experimentation and trial-and-error problem-solving, including the development of regulatory programs that use non-traditional tools.

Entrepreneurial administration takes place both at public agencies and private entities, each of which can address regulatory challenges and earn regulatory authority as a …

Performative Privacy, Scott Skinner-Thompson

Publications

Broadly speaking, privacy doctrine suggests that the right to privacy is non-existent once one enters the public realm. Although some scholars contend that privacy ought to exist in public, “public privacy” has been defended largely with reference to other, ancillary values privacy may serve. For instance, public privacy may be necessary to make the freedom of association meaningful in practice.

This Article identifies a new dimension of public privacy, supplementing extant justifications for the right, by arguing that many efforts to maintain privacy while in “public” are properly conceptualized as forms of performative, expressive resistance against an ever-pervasive surveillance society. …

Privacy And The Right To Record, Margot E. Kaminski

Publications

Many U.S. laws protect privacy by governing recording. Recently, however, courts have recognized a First Amendment “right to record.” This Article addresses how courts should handle privacy laws in light of the developing First Amendment right to record.

The privacy harms addressed by recording laws are situated harms. Recording changes the way people behave in physical spaces by altering the nature of those spaces. Thus, recording laws can be placed within a long line of First Amendment case law that recognizes a valid government interest in managing the qualities of rivalrous physical space, so as not to allow one person’s …

Health Information Equity, Craig Konnoth

Publications

In the last few years, numerous Americans’ health information has been collected and used for follow-on, secondary research. This research studies correlations between medical conditions, genetic or behavioral profiles, and treatments, to customize medical care to specific individuals. Recent federal legislation and regulations make it easier to collect and use the data of the low-income, unwell, and elderly for this purpose. This would impose disproportionate security and autonomy burdens on these individuals. Those who are well-off and pay out of pocket could effectively exempt their data from the publicly available information pot. This presents a problem which modern research ethics …

Standing After Snowden: Lessons On Privacy Harm From National Security Surveillance Litigation, Margot E. Kaminski

Publications

Article III standing is difficult to achieve in the context of data security and data privacy claims. Injury in fact must be "concrete," "particularized," and "actual or imminent"--all characteristics that are challenging to meet with information harms. This Article suggests looking to an unusual source for clarification on privacy and standing: recent national security surveillance litigation. There we can find significant discussions of what rises to the level of Article III injury in fact. The answers may be surprising: the interception of sensitive information; the seizure of less sensitive information and housing of it in a database for analysis; and …

An Expressive Theory Of Privacy Intrusions, Craig Konnoth

Publications

The harms of privacy intrusions are numerous. They include discrimination, reputational harm, and chilling effects on speech, thought, and behavior. However, scholarship has yet to fully recognize a kind of privacy harm that this article terms "expressive."

Depending on where the search is taking place and who the actors involved are--a teacher in a school, the police on the street, a food inspector in a restaurant--victims and observers might infer different messages from the search. The search marks the importance of certain societal values such as law enforcement or food safety. It can also send messages about certain groups by …

When The Default Is No Penalty: Negotiating Privacy At The Ntia, Margot E. Kaminski

Publications

Consumer privacy protection is largely within the purview of the Federal Trade Commission. In recent years, however, the National Telecommunications and Information Administration (NTIA) at the Department of Commerce has hosted multistakeholder negotiations on consumer privacy issues. The NTIA process has addressed mobile apps, facial recognition, and most recently, drones. It is meant to serve as a venue for industry self-regulation. Drawing on the literature on co-regulation and on penalty defaults, I suggest that the NTIA process struggles to successfully extract industry expertise and participation against a dearth of federal data privacy law and enforcement. This problem is most exacerbated …

Classification Standards For Health Information: Ethical And Practical Approaches, Craig Konnoth

Publications

Secondary health information research requires vast quantities of data in order to make clinical and health delivery breakthroughs. Restrictive policies that limit the use of such information threaten to stymie this research. While the Notice of Proposed Rulemaking (NPRM) for the new Common Rule permits patients to provide broad consent for the use of their information for research, that policy offers insufficient flexibility. This Article suggests a flexible consenting system that allows patients to consent to a range of privacy risks. The details of the system will be fleshed out in future work.

Outing Privacy, Scott Skinner-Thompson

Publications

The government regularly outs information concerning people's sexuality, gender identity, and HIV status. Notwithstanding the implications of such outings, the Supreme Court has yet to resolve whether the Constitution contains a right to informational privacy - a right to limit the government's ability to collect and disseminate personal information.

This Article probes informational privacy theory and jurisprudence to better understand the judiciary's reluctance to fully embrace a constitutional right to informational privacy. The Article argues that while existing scholarly theories of informational privacy encourage us to broadly imagine the right and its possibilities, often focusing on informational privacy's ability to …

A Prospect Theory Of Privacy, Bryan H. Choi

Publications

Privacy law has languished for decades while the other information law doctrines have flourished. This paradox can be explained by the relative weight assigned respectively to moral argument versus economic argument. Privacy law is unique in that it continues to be steered foremost by moral intuition. What qualifies as a "violation" of privacy is predicated largely on the moral reprehensibility of the act in question. By stark contrast, the intellectual property regimes have long since converted to being led primarily by economic considerations, and only secondarily by noneconomic factors.

That distinction is counterproductive and nonsensical. Personal data is an informational …

For Whom The Data Tolls: A Reunified Theory Of Fourth And Fifth Amendment Jurisprudence, Bryan H. Choi

Publications

Data privacy demands a reunified theory of the Fourth and Fifth Amendments. Data technologies allow personal information to be disembodied from physical bodies and “possessed” simultaneously by both first persons and third parties. As a result, the government has been able to use a divide-and-conquer strategy to obtain incriminating evidence alternately from the data intermediary or from the suspect.

Currently, Fourth Amendment doctrine and Fifth Amendment doctrine work at cross-purposes. The privacy community has already sounded the alarm on the “third-party doctrine,” which allows the government to sidestep the Fourth Amendment when demanding evidence from third parties. But few have …

Robots In The Home: What Will We Have Agreed To?, Margot E. Kaminski

Publications

A new technology can expose the cracks in legal doctrine. Sometimes a technology resists analogy. Sometimes, through analogies, it reveals inconsistencies in the law, or basic flaws in framing, or in the fit between different parts of the legal system. This Essay addresses robots in the home, and what they reveal about U.S. privacy law. Household robots might not themselves uproot U.S. privacy law, but they will reveal its inconsistencies, and show where it is most likely to fracture. Just as drones are serving as a legislative “privacy catalyst” — encouraging the enactment of new privacy laws as people realize …

Regulating Real-World Surveillance, Margot E. Kaminski

Publications

A number of laws govern information gathering, or surveillance, by private parties in the physical world. But we lack a compelling theory of privacy harm that accounts for the state's interest in enacting these laws. Without a theory of privacy harm, these laws will be enacted piecemeal. Legislators will have a difficult time justifying the laws to constituents; the laws will not be adequately tailored to legislative interest; and courts will find it challenging to weigh privacy harms against other strong values, such as freedom of expression.

This Article identifies the government interest in enacting laws governing surveillance by private …

Regulating The Internet Of Things: First Steps Toward Managing Discrimination, Privacy, Security, And Consent, Scott R. Peppet

Publications

The consumer "Internet of Things" is suddenly reality, not science fiction. Electronic sensors are now ubiquitous in our smartphones, cars, homes, electric systems, health-care devices, fitness monitors, and workplaces. These connected, sensor-based devices create new types and unprecedented quantities of detailed, high-quality information about our everyday actions, habits, personalities, and preferences. Much of this undoubtedly increases social welfare. For example, insurers can price automobile coverage more accurately by using sensors to measure exactly how you drive (e.g., Progressive 's Snapshot system), which should theoretically lower the overall cost of insurance. But the Internet of Things raises new and difficult questions …

Real Masks And Real Name Policies: Applying Anti-Mask Case Law To Anonymous Online Speech, Margot E. Kaminski

Publications

The First Amendment protects anonymous speech, but the scope of that protection has been the subject of much debate. This Article adds to the discussion of anonymous speech by examining anti-mask statutes and cases as an analogue for the regulation of anonymous speech online. Anti-mask case law answers a number of questions left open by the Supreme Court. It shows that courts have used the First Amendment to protect anonymity beyond core political speech, when mask-wearing is expressive conduct or shows a nexus with free expression. This Article explores what the anti-mask cases teach us about anonymity online, including proposed …

Drone Federalism: Civilian Drones And The Things They Carry, Margot E. Kaminski

Publications

Civilian drones are scheduled to be permitted in the national airspace as early as 2015. Many think Congress should establish the necessary nationwide regulations to govern both law enforcement and civilian drone use. That thinking, however, is wrong. This Essay suggests drone federalism instead: a state-based approach to privacy regulation that governs drone use by civilians, drawing on states’ experience regulating other forms of civilian-on-civilian surveillance. This approach will allow necessary experimentation in how to best balance privacy concerns against First Amendment rights in the imminent era of drone-use democratization. This Essay closes by providing some guidance to states as …

Reading Over Your Shoulder: Social Readers And Privacy Law, Margot Kaminski

Publications

No abstract provided.

Privacy & The Personal Prospectus: Should We Introduce Privacy Agents Or Regulate Privacy Intermediaries, Scott R. Peppet

Publications

No abstract provided.

Unraveling Privacy: The Personal Prospectus And The Threat Of A Full-Disclosure Future, Scott R. Peppet

Publications

Information technologies are reducing the costs of credible signaling, just as they have reduced the costs of data mining and economic sorting. The burgeoning informational privacy field has ignored this evolution, leaving it unprepared to deal with the consequences of these new signaling mechanisms. In an economy with robust signaling, those with valuable credentials, clean medical records, and impressive credit scores will want to disclose those traits to receive preferential economic treatment. Others may then find that they must also disclose private information to avoid the negative inferences attached to staying silent. This unraveling effect creates new types of privacy …

Beyond Fair Use, Gideon Parchomovsky, Philip J. Weiser

Publications

For centuries, the fair use doctrine has been the main--if not the exclusive--bastion of user rights. Originating in the English courts of equity, the doctrine permitted users, under appropriate circumstances, to employ copyrighted content without the rightsholder's consent. In the current digital media environment, however, the uncertainty that shrouds fair use and the proliferation of technological protection measures undermine the doctrine and its role in copyright policy. Notably, the enactment of the Digital Millennium Copyright Act, which prohibits the circumvention of technological protection measures even for fair use purposes, has diminished the ability of fair use to counterbalance a copyright …

Substitution Effects: A Problematic Justification For The Third-Party Doctrine Of The Fourth Amendment, Blake Ellis Reid

Publications

In the past half-century, the Supreme Court has crafted a vein of jurisprudence virtually eliminating Fourth Amendment protection in information turned over to third parties - regardless of any subjective expectation of privacy or confidentiality in the information on the part of the revealer. This so-called “third-party” doctrine of the Fourth Amendment has become increasingly controversial in light of the growing societal reliance on the Internet in the United States, where nearly every transaction requires a user to turn information over to at least one third party: the Internet service provider (“ISP”).

Citing the scholarship that has criticized the third-party …

Book Review, Susan Nevelow Mart

Publications

No abstract provided.

Garbage Pails And Puppy Dog Tails: Is That What Katz Is Made Of?, Aya Gruber

Publications

This Article takes the opportunity of the fortieth anniversary of Katz v. U.S. to assess whether the revolutionary case's potential to provide broad and flexible privacy protection to individuals has been realized. Answering this question in a circumspect way, the Article pinpoints the language in Katz that was its eventual undoing and demonstrates how the Katz test has been plagued by two principle problems that have often rendered it more harmful to than protective of privacy. The manipulation problem describes the tendency of conservative courts to define reasonable expectations of privacy as lower than the expectations society actually entertains. The …

The Chains Of The Constitution And Legal Process In The Library: A Post-Usa Patriot Reauthorization Act Assessment, Susan Nevelow Mart

Publications

Since the Patriot Act was passed in 2001, controversy has raged over nearly every provision. The controversy has been particularly intense over provisions that affect the patrons of libraries. This article follows those Patriot Act provisions that affect libraries, and reviews how they have been interpreted, how the Patriot Reauthorization Acts have changed them, and what government audits and court affidavits reveal about the use and misuse of the Patriot Act. The efforts of librarians and others opposed to the Patriot Act have had an effect, both legislatively and judicially, in changing and challenging the Patriot Act. Because libraries are …

Structural Rights In Privacy, Harry Surden

Publications

This Essay challenges the view that privacy interests are protected primarily by law. Based upon the understanding that society relies upon nonlegal devices such as markets, norms, and structure to regulate human behavior, this Essay calls attention to a class of regulatory devices known as latent structural constraints and provides a positive account of their role in regulating privacy. Structural constraints are physical or technological barriers which regulate conduct; they can be either explicit or latent. An example of an explicit structural constraint is a fence which is designed to prevent entry onto real property, thereby effectively enforcing property rights. …